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This paper presents the mitigation effects of fission product reduction strategies that can be applied to severe 
accident management for CANDU6 plants. Strategy effects for ‘control of the reactor building condition’ and 
‘reduction of the fission product release’ have been evaluated. The operations of a dousing spray system, local 
air cooler system, and containment filtered vent system are simulated as severe accident management strategies. 
The present analysis is mainly focused on determining an estimate of the fission products in the release and 
transport processes, i.e., (1) their release from the reactor core, (2) their distribution in a primary heat transport 
system, calandria vessel, molten corium, and reactor building, and (3) their release from the reactor building 


into the environment during a severe accident. 
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I. INTRODUCTION 


Severe accident management guidance (SAMG) for a 
CANDU6 type reactor was developed by KAERI (Korea 
Atomic Energy Research Institute) [1, 2]. This SAMG has 
six severe accident guidelines (SAGs). SAGs describe opera- 
tor actions that may mitigate or terminate the progression of 
a severe accident and the release of fission products out of 
the reactor building. One of the six SAGs is the strategy of 
"reduction of a fission product release." 


Wolsong unit 1, which is a typical CANDU6 plant, was 
recently chosen to be back-fitted with a wet-style contain- 
ment filtered vent system (CFVS). If the operational strategy 
of the CFVS is well established, it will greatly reduce the 
threat from a steam over the pressurization failure mode of 
the reactor building (or containment). In addition, it will min- 
imize the uncontrolled releases of airborne particulate radio- 
nuclides and radio-iodine isotopes into the environment by 
means of controlled filtering. 


During a severe nuclear accident, an analysis of the source 
term and relevant fission product (FP) behavior is an essen- 
tial part for the accident management of nuclear power plants 
and emergency planning. This paper presents the mitigation 
effects of fission product reduction strategies that can be ap- 
plied to severe accident management for CANDU6 plants. 
Strategy effects for ‘control of the reactor building condition’ 
and ‘reduction of the fission product release’ have been eval- 
uated. The operations of a dousing spray system, local air 
cooler system, and containment filtered vent system are sim- 
ulated as severe accident management strategies. 
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Il. METHODOLOGY 


Severe accident phenomenological analyses for the evalua- 
tion have been performed using the ISSAC (Integrated Severe 
Accident Analysis Code for the CANDU Plants) 4.03 [3]. 
The code is “a system-level computer code capable of per- 
forming integrated analyses of severe accident progression, 
supporting level 2 probabilistic safety assessment studies or 
accident management strategy developments” [4]. It was de- 
veloped based on MAAP4 [4], and predicts an accident pro- 
gression by modeling CANDU6-specific systems and ex- 
pected physical phenomena based on the current understand- 
ing of the unique accident progressions. 


Based on a previous analysis [5], the accident progression 
of a CANDU6 type reactor until corium relocation into the 
calandria vessel bottom is considerably earlier than those for 
the typical PWR or BWR4. This results from the design dif- 
ferences with other plants. The OPR-1000, a typical PWR, is 
equipped with turbine driven auxiliary feed water systems and 
main steam safety valves, which can provide a secondary feed 
and bleed function for the station blackout (SBO) scenario us- 
ing battery power. The BWR4/MARK1 plant has mitigation 
systems of a high pressure coolant injection (HPCT) and re- 
actor core isolation cooling (RCIC) against an SBO accident. 
The systems are operable with no electric power other than 
battery power. On the other hand, the failure time of the ca- 
landria (vessel) in CANDU6 is greatly delayed compared to 
the others. The delay is due to the additional cooling wa- 
ter in the calandria vessel and the calandria vault (CV), and 
the lower volumetric decay heat power of the molten corium 
on the calandria vessel bottom. In contrast with the calan- 
dria vessel integrity, the containment failure of a CANDU6 
plant occurs considerably earlier than that of a PWR owing 
to the lower failure pressure of the containment. CANDU6 
has an advantage in maintaining its calandria integrity, and an 
OPR- 1000 PWR has an advantage in its containment integrity 
during an SBO accident. However, a proper mitigative oper- 
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ation of the vent systems has a potential to delay or prevent 
the containment failure in a CANDU6 and BWR4/MARK 1. 
Therefore, plant responses against severe core damage sce- 
narios like the Fukushima accident are expected to be very 
different. 

The generic models of the ISAAC evolved from the 
MAAP4. Some of these models required minor modifica- 
tions to adapt them to CANDU6 design features and integra- 
tion with the rest of the code, but fundamentally these mod- 
els were unchanged from the generic MAAP4 models. As a 
CANDU6 type reactor differs from typical PWR/BWRs, the 
CANDU6-specific features are newly modeled and added to 
the ISAAC code. The CANDU6-specific models include the 
calandria vessel, end shields, reactor vault, pressure and in- 
ventory control, and engineered safety systems (e.g., dousing, 
emergency core cooling). 

The ISAAC evaluates a wide spectrum of phenomena in- 
cluding the steam formation; core heat-up; cladding oxida- 
tion and hydrogen evolution; vessel failure; corium-concrete 
interactions; ignition of combustible gases; fluid entrainment 
by high-velocity gases; and fission-product release, transport, 
and deposition. The code also addresses important engineer- 
ing safety systems and allows a user to model the operator 
interventions. Furthermore, models are added to characterize 
the actions that could stop an accident, i.e., in-vessel cooling, 
external cooling of the reactor vessel, and ex-vessel cooling. 
Moreover, mathematical solution techniques are implemented 
to maintain a quick-running code suitable for extensive ac- 
cident screening and parameter sensitivity analysis applica- 
tions. 

The article [6] describes about the FP model of ISAAC: 
“ISAAC contains FP behavior models that calculate the re- 
lease of FPs from the core and the transport and deposition 
in the primary heat transport system (PHTS) and in the re- 
actor building (R/B) as well as the release of FPs into the 
environment. The code sorts the initial masses of 22 FP el- 
ements into twelve groups and then tracks the mass of each 
group in each of four physical states (vapor, aerosol, surfaces- 
deposited, and corium -contained) in the various components 
of the PHTS and R/B”. 

Table 1 shows the twelve fission product groups for the 
22 elements. The elements are grouped according to their 
chemical and transport characteristics. Group 12 is reserved 
for UOz2 fuel. Some elements such as cesium, rubidium, and 
tellurium are present in more than one group. Cs and Rb are 
in groups 2 and 6, and Te is in groups 3 and 11. 

A station blackout scenario (SBO) is simulated as an ini- 
tiating event of sequence. The definition of an SBO for 
CANDU6 is useful to quote from the reference [6]: “In 
SBO, where all off-site power is lost and the diesel genera- 
tors (DGs) fail. The scenario has been taken as a very low- 
frequency, but high-risk, accident event. All current genera- 
tion reactors are only partially designed to cope with an SBO. 
During an SBO event, the initiating event is a loss of Class IV 
and Class III power, causing a loss of pumps used in systems 
such as the primary heat transport system, moderator cooling, 
shield cooling, steam generator feed water, and recirculating 
cooling water.” The Class IV power supplies AC loads that 
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Table 1. List of FP release groups in ISAAC code. 


Group Number Fission Product 
Nobles (Xe, Kr) 
CsI, RbI 


MoO», RuOg, TcOg, RbO2 
CsOH, RbOH 
BaO 


OAmAANINDNHWNK 


CeO, NpOzg, PuO, 

10 Sb 

11 Tes 

12 UO» (Fuel, Not fission product) 


can be interrupted indefinitely without affecting the person- 
nel or plant safety and the Class III power supplies AC loads 
that can tolerate a short interruption (1 to 3 minutes) required 
to start the standby generators without affecting the personnel 
or plant safety, but are required for a safe plant shutdown. 

“The SBO base case does not credit any of these active heat 
sinks, but relies only on passive heat sinks, particularly the 
initial water inventories of the PHTS, moderator, steam gen- 
erator (SG) secondary side, end shields, and calandria vault 
(CV)” [6]. 


II. BRIEF OUTLINES OF CANDU6 DESIGN FEATURES 


The application was performed for Wolsong-1 plant as a 
reference plant of a typical CANDU6. A CANDU6 is a heavy 
water-moderated, natural uranium-fuelled, pressurized heavy 
water reactor with a thermal output of about 2 140 MW,y. 
A brief design features of CANDU6 is well described in the 
previous study[7]: “A PHTS consists of two loops and each 
loop has 190 horizontal fuel channels that are surrounded by a 
heavy water moderator inside a horizontal calandria vessel”. 
The calandria vessel is housed in and supported by a light 
water-filled steel-lined concrete vault, called a calandria vault 
(CV), which provides thermal shielding. A significant quan- 
tity of heavy water surrounding the fuel acts as a heat sink to 
remove the decay heat after a reactor shutdown. The heavy 
water moderator ( 2.16x 10° kg) in the calandria is a unique 
CANDU feature that provides a passive heat sink for certain 
accident scenarios. “The CV is built of ordinary concrete and 
is filled with about 5.0 10° kg of light water which functions 
as a biological shield under normal operating conditions and 
as a passive heat sink under certain severe accident scenar- 
ios. For example, if hot dry debris is collected in the calan- 
dria bottom after a core relocation, the CV water will remove 
the decay heat from the calandria through the calandria wall. 
In-vessel retention through external vessel cooling, which is 
considered an important accident management program in a 
PWR, is inherent in the CANDU design [7]. 

As the CANDU6 has the above-mentioned additional water 
inventory, the role of a containment heat removal system such 
as a dousing spray or local air coolers becomes important 
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to control the containment pressure below the failure pres- 
sure. “The dousing spray system is designed to limit the mag- 
nitude and duration of the containment over-pressure. The 
system is automatically initiated when the containment pres- 
sure exceeds 14 kPa,,)” [7]. However, the effect of dousing 
sprays on long-term heat removal is not significant because 
the sprays are designed only for short- term use. The contain- 
ment design pressure of the modeled CANDU6 plant is 0.124 
MPa,,), the median value of a containment failure pressure 
is 0.426 MPac,), and the total net volume is approximately 
48 000 më. At this failure pressure, the concrete on the wall 
starts cracking and the pressure can be relieved. The design 
parameters of the Wolsong-1 plant are summarized in Table 2. 


IV. ANALYSIS CASES AND ASSUMPTION 


The base case of an SBO accident sequence has been mod- 
eled with the loss of class IV, and all back-up power includ- 
ing loss of all on-site standby and emergency electric power 
supplies. A reactor shutdown is initiated immediately after 
an accident initiation. The high/medium/low pressure emer- 
gency core cooling, crash-cooling function, shut-down cool- 
ing, moderator cooling, and shield cooling systems are un- 
available. Operator intervention for the local air coolers is 
not credited. The passive containment dousing spray system 
is working. The main steam isolation valves (MSIVs) are not 
modeled, and instead the turbine bypass valves and turbine 
stop valves are closed, which results in the same pressure 
behavior in the four SGs. Liquid relief valves (LRVs) and 
pressurizer relief valves are assumed to discharge the PHTS 
inventory into the R/B through the degasser condenser tank. 
There is an assumption that the relocated molten corium on 
the calandria bottom will be coolable in the CANDU6 plant 
because the so-called in-vessel corium retention by external 
vessel cooling is very feasible [8]. For the molten core con- 
crete interaction (MCCI) calculation, the molten corium has 
been assumed to be spread into the entire floor of the CV 
(54.2 m?). 

The base case analysis is followed by three sensitivity cases 
assuming certain system availabilities to assess their mitigat- 
ing effects. Case 1 is similar to the base case, except that the 
dousing tank inventory is injected into the SGs and no wa- 
ter is available as a dousing spray. The SG crash cool-down 
is available to depressurize the SGs. The dousing tank inven- 
tory is assumed to be injected into four SGs when the pressure 
is decreased enough after a crash cool-down operation. 

Case 2 the operation of the CFVS. If the R/B sprays or 
local air coolers are unavailable, the depressurization by the 
CFVS can be considered an alternative mitigation strategy. 
For example, the CFVS is under construction in Wolsong-1. 
In the CFVS, it is assumed that the diameter of the orifice is 
0.2548 m, the CsI removal rate is 99.99 %, and it is operated 
between 225 kPa(a) and 151 kPa(a) [9]. 

Case 3 is the recovery of a local air cooler system. This 
local air cooler system consists of 35 units. Among them, 
sixteen local air coolers have a safety function and are capable 
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of operating in the harsh environment caused by an accident. 
After a loss of Class IV power, the sixteen local air coolers 
operate in Class III power. Twelve out of the sixteen local air 
coolers, which have a safety function during an accident, are 
assumed to be operable at 10 h after an accident initiation. 


V. ANALYSIS RESULTS 


In the base case analysis, the transient is initiated by a loss 
of all AC power with all emergency core cooling systems un- 
available, and the sequence progresses to a severe core dam- 
age accident. The water in the SG secondary side boils off 
as the heat is transferred from PHTS to SGs. As a result, 
the SG secondary side pressure increases gradually and the 
main steam safety valve (MSSV) is open and the steam is 
discharged from the SG to the environment outside the R/B. 
As the boil-off proceeds, the water in the SGs is depleted at 
about 2.8 h (Table 3) and the SGs are no longer a heat sink of 
the PHTS. Thus, the PHTS pressure starts to increase until it 
reaches the set point of PHTS liquid relief valve (LRV) (10.16 
MPa). A fuel channel dryout occurs as the PHTS inventory is 
gradually lost through the LRVs. 

In parallel, as the water level in the calandria vessel de- 
creases gradually, a fuel channel with the highest decay power 
ruptures at 4 h, where the moderator cooling is assumed to be 
unavailable. 

After the fuel channel rupture and corium relocation, the 
remaining water in the calandria vessel dried out and the fis- 
sion products released from the calandria vessel into an R/B. 
The moderator of the calandria vessel is depleted at about 
12.2 h (Table 3). The water in the calandria vessel acts as 
a heat sink to cool the external calandria vessel wall. Steam 
generated in the calandria vault (CV) is released into the R/B. 
When the water level in the CV reaches the calandria ves- 
sel bottom, the vessel bottom heats up rapidly by the decay 
heat of the corium inside, and the vessel fails owing to creep. 
When the calandria vessel fails at 46.2 hours, the debris relo- 
cates into the CV, where it is cooled by the water. 

Figure 1 shows the pressure behavior in an R/B for all 
cases. After accident initiation, the R/B pressure increases 
gradually, because water is discharged into the R/B through 
the PHTS LRVs. The pressure peaks as shown in the base 
case of Figure 1 at approximate times of 4.0 h, 12.2 h, 22.7 
h, 46.2 h, and 130.6 h can be explained by the following pro- 
cesses, which occur at these respective times: (1) a fuel chan- 
nel rupture, (2) water dryout in the calandria vessel, (3) R/B 
failure, (4) calandria vessel failure and corium relocation into 
the CV, and (5) corium relocation into the basement after CV 
bottom failure by MCCI. The water in the CV reaches the 
saturation temperature at about 17.0 h, and begins to boil off, 
thus gradually increasing the R/B pressure. At about 22.7 h, 
the R/B pressure reaches the failure set point of 426 kPa(a), 
resulting in R/B failure. 

In Case 1, the dousing tank inventory is injected into SGs 
and no water is available for the dousing spray. The SG crash 
cool-down is available to depressurize the SGs. The dousing 
tank inventory is assumed to be injected into four SGs when 
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Table 2. Design parameters of Wolsong-1 plant 


Design Parameters Specifications 
Plant Type CANDU6 
Power (MW:n) 2,140 
Coolant Inventory (10° kg) Steam Generator 151 
PHTS 215 
Calandria 216 
Calandria Vault 500 
Core Material (10° kg) UO2 99 
Zircaloy 43 


Mitigation System against SBO 


Dousing Spray, CFVS 


R/B Free Volume (m?) 48,000 
R/B Failure Pressure (10°Pa,)) 0.426 
Table 3. Accident progression for the analyzed cases 

Event Summary Time (unit: hours) 

Base Casel Case2 Case3 
Dousing tank water injection into SGs N/A 2.0 N/A N/A 
SG inventory depletion 2.8 37.8 2.8 2.8 
Fuel channel rupture 4.0 49.9 4.0 4.0 
CFVS first open N/A N/A 6.5 N/A 
LAC operation start N/A N/A N/A 10.0 
Calandria inventory depletion 12.2 61.5 10.9 12.2 
R/B(Containment) failure 22.7 83.2 119.3 No Fail 
Calandria vessel failure 46.2 114.3 44.2 47.7 


the pressure is decreased enough after the crash cool-down 
operation. The decay heat can be removed through the SGs, 
resulting in delaying the accident progression for a significant 
duration, as shown in Case 1 of Table 3 and Fig. 1. 

The analysis results of Case 2 show that the R/B pressure is 
controlled between the CFVS actuation and closure pressures 
during most accident periods, but two peak spikes appeared to 
be uncontrolled. The first peak occurs at the time of the calan- 
dria vessel failure (44.2 h) when corium is relocated into the 
CV water. The second peak occurs at the time of a CV bottom 
(concrete floor) penetration failure (119.3 h) by MCCI when 
corium is relocated into the basement water, which results in 
an R/B failure. 

Twelve out of the sixteen local air coolers are assumed to 
be recovered at 10 hours after an accident initiation for Case 
3. There is no pressure buildup in R/B owing to the sufficient 
cooling capacity of the air coolers. 

In this paper, an analysis is focused on the FP release from 
a core, the fission product distribution inside a plant, and the 
fission product release from an R/B into the environment. The 
FP behavior during an accident is strongly dependent on the 
thermal hydraulic or severe accident phenomenological con- 
ditions that were previously discussed. 

CsI is selected as the representative FP. The reason is ex- 
pressed by a previous study [10]: “Among the FP groups, 
the noble gas and cesium iodine groups are considered more 
volatile. Noble gas, which is a chemically inert material, 
poses a considerably lesser danger to human health. Instead, 
iodine is one of the elements vital to the proper functioning 
of the human body. Iodine exits from damaged fuel rods pre- 
dominantly as cesium iodine (CsI) during severe accidents 


rather than as molecular iodine (I2).” 

Figure 2 illustrates the CsI behavior as a representative FP 
for the base case. The CsI release into the PHTS occurs after 
the fuel damage. Since fuel channels are ruptured at 4.0 hours 
after the accident initiation (Table 2), CsI can be transported 
into the containment. Moreover, when molten fuel relocation 
starts, the CsI is included in the molten corium. The CsI in 
the corium is released into the R/B only after the MCCI starts, 
and the water of the calandria vault is dried out at about 57 
hours. About 5.8%, 91.5% and 2.6% of the initial CsI mass 
are distributed in the PHTS, R/B, and the environment, re- 
spectively. The release time of FPs into the environment is 
about 22.7 h. 

The operation of the dousing spray in Case 1 delays the 
R/B failure and FP release into the environment (Fig. 3). 
About 6.0%, 86.7% and 6.9% of the initial CsI inventory is 
distributed in the PHTS, R/B, and environment, respectively. 
Figure 4 shows the results of Case 2 where a CFVS operation 
prevents the R/B failure during a very long time, and reduces 
the FP release rate significantly. The release rate of CsI is 
reduced to 0.03%. However, the FP release initiation occurs 
very early (6.5 h) owing to the CFVS operation. Meanwhile, 
the control of the R/B condition using LACs (Case 3) main- 
tains the building integrity without any FP release into the 
environment owing to a sufficient cooling capacity (Fig. 5). 


VI. SUMMARY 


In this paper, the mitigation effects of tentative FP reduc- 
tion strategies that can be applied to a severe accident man- 
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Fig. 1. (Color online) Pressure behaviors in the R/B for all cases. 
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Fig. 2. (Color online) CsI distribution for Base Case. 
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Fig. 3. (Color online) CsI distribution for Case 1. 


agement for CANDU6 plants was evaluated based on the 
ISAAC computer program. The alternate usage of a dousing 
spray system, the recovery of a local air cooler system, and 
the operation of a containment filtered vent system are con- 
sidered as severe accident management strategies of "control 
of the reactor building condition" and "reduction of the fission 
product release." 

The decay heat can be removed through the injection of 
dousing tank inventory into SGs with a crash cool-down op- 
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Fig. 4. (Color online) CsI distribution for Case 2. 
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Fig. 5. (Color online) CsI distribution for Case 3. 


eration, which results in delaying the accident progression for 
a significant duration. Meanwhile, even if the operation of 
CFVS is not an effective risk management policy because of 
an early FP release, the strategy can be proposed to prevent 
a catastrophic R/B failure and reduce the amount of FP re- 
lease effectively. The most effective means for the R/B in- 
tegrity is LAC recovery as long as the power can be recov- 
ered. The control of the R/B condition using LACs maintains 
the building integrity without any FP release into the environ- 
ment owing to a sufficient cooling capacity of the air coolers 
in CANDU6 plants. 

The limitations of this analysis may result from uncertain 
severe accident phenomena, for example, the fuel melting 
process, calandria vessel failure mechanism, reactor building 
failure mode, and fission product release/ transport. Uncer- 
tainties should be inherently very large for an analysis of se- 
vere accident phenomena. In addition, an assessment that re- 
lies on one computer code is not necessarily reliable in an ab- 
solute manner though a relative comparison of SAMG strate- 
gies on the same basis would be very useful. 

Unlike a light water reactor, the evaluation results for 
the accident management strategies of a heavy water reac- 
tor are very limited. Therefore, this study is aimed at the 
development of feasible accident management strategies for 
CANDU6 plants that have yet to be addressed. 
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